CVE-2026-46137

The mptcp_pm_add_timer() function is invoked as a timer callback in softirq context. In this context, to prevent data-races, it is necessary to acquire socket lock using bh_lock_sock(). Without this mechanism, concurrent access to protected resources from different execution contexts is possible. The patch introduces retry after a short time if the socket is currently busy — similar to the keepalive timer behavior.

An attacker or malicious process can compromise the confidentiality, integrity, and availability of the system by exploiting a data-race in MPTCP connection management.

Apply patches available from the vendor according to references (commits available in kernel.org repository: 013dcdc1, 2ad56e43, 5cd6e0ad, 6e4710d7, cc3c0399).

Linux kernel with MPTCP support — versions indicated in vendor references (upstream and stable commits).